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ask+request-6087-677 7c49b @ askthccu.org 


Subject: Your confirmatory application pursuant to Article 7(2) of Regulation (EC) 

No 1049/2001 - application for access to documents (ref* 

Ares(2018)6593409) 


Dear Mr Coluccini* 

I refer to your email of 19 December 2018 sent via the website AskTheEU.org and registered 
by the Research Executive Agency (REA) on 20 December 2018 under reference number 
Ares(2018)6593409, You request* pursuant to Regulation (EC) No 1049/2001 regarding 
public access to European Parliament* Council and Commission documents 1 , a review of the 
position taken by REA with regard to the initial request for access to documents. 

1. SCOPE OF YOUR REQUEST 

On 2 November 2018, the European Commission received your initial application for access 
to documents submitted via the website AskTheEU.org and concerning the project 
iBorderCtrl (grant agreement nr. 700626) managed by REA. 

On 5 November 2018, the request was reassigned to REA. 

In your application you requested: 

“All the deliverables listed in the 'Publication section of the project iBorderCtrl * Project ID: 
700626 Funded under: H2020-EU3.7, - Secure societies - Protecting freedom and security 
of Europe and its citizens: https ://www\ iharderctrLea/Pithl [cations 1 

In the project website the following deliverables appear under ^t Publications ,, : 

Dl. 1 Ethics advisor's first report 

D1.2 Ethics of profiling, the risk of stigmatization of individuals and mitigation plan 
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D1.3 Ethics Advisor 

D2.1 Requirement Analysis Report 

D2.2 Reference Architecture and components specifications 
D2.3 EU wide legal and ethical review report 
D3.1 Data Collection Devices - specifications 

D3.2 First version of all technological tools and subsystems (Portable unit, ADDS, DAAT, 
portable radar, FMT. Avatar based dialogue) 

D3.3 Second version of all technological tools and subsystems for integration 
D4.1 First version of the iBorderCtrl software platform 
D4.2 Second version of the iBorderCtrl software platform 
D5.1 Integration Plan 

D5.2 Early version of the integrated prototype (limited functionality) 

D6.1 Experimental Design for Pilot Deployment and Evaluation 
D7.1 Project Web Portal 
D7.2 Project flyer 

D7.3 Dissemination and communication plan 
D7.4 Early Business Plan 

D7.6 Yearly communication report including communication material 
D7.7 Project Flyer 2 

D7.8 Dissemination and communication plan 2 

D8.1 Quality Management Plan 

D8.3 Periodic Progress Report 

D8.4 Annual Report 

D8.5 Periodic Progress Report 2 

D8.7 Annual Report 2. 

On 26 November 2018, REA informed you of the extension of the time limit by additional 15 
working days, in accordance with Article 7(3) of the Regulation because the documents 
requested originated from third parties that had to be consulted. 

On 17 December 2018, REA replied to your initial application (reference Ares 
(2018)6503962). In its letter REA provided an inventory of the documents related to the 
request (Annex 1 of the reply), containing reference to the documents directly accessible and 
specifying for each document non-disclosed or partially disclosed the legal grounds on which 
REA based its decision. 

In particular, REA has partially disclosed deliverables D.3.1, D.3.2 and D.3.3, fully disclosed 
deliverables D.7.2 and D.7.7 and deliverables D7.1 and D7.6 are publicly available on the 
project website (https://www.iborderctrl.eu/Publications) . 

The access to the other requested deliverables have been refused based on the exceptions 
relating to the protection of the privacy and integrity of the individual and/or of commercial 
interests of a natural or legal person, laid down respectively in Articles 4(1 )(b) and 4(2), first 
indent, of Regulation (EC) No 1049/2001. 

On 20 December 2018, REA registered your confirmatory application, pursuant to Article 
7(2) of Regulation (EC) No 1049/2001. 

Through your confirmatory application, you request a review of the position taken by REA on 
your initial request with regard to the following documents to which access was denied based 
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on the protection of the privacy and integrity of the individual and the protection of 
commercial interests of a natural or legal person: 

Dl.l Ethics advisor's first report 

D1.2 Ethics of profiling, the risk of stigmatization of individuals and mitigation plan 

D1.3 Ethics Advisor 

D2.1 Requirement Analysis Report 

D2.3 EU wide legal and ethical review report. 

Although you requested that the scope of the review be limited to the above-mentioned 
documents, following the re-assessment made in the context of another request of access, 
REA is now in position to grant you a partial access to deliverables D7.3 (Dissemination and 
communication plan) and D7.8 (Dissemination and communication plan 2). 

2. ASSESSMENT OF YOUR CONFIRMATORY APPLICATION 

When assessing a confirmatory application for access to documents, REA conducts a fresh 
review of the reply given at the initial stage in light of the provisions of Regulation 
1049/2001. 

Following this review, I regret to inform you that I have to confirm the initial decision of 
REA to refuse access to the requested documents (i.e. Dl.l, D 1.2, D 1.3, D2.1, D2.3) based on 
the exceptions of Article 4(1 )(b) (protection of the privacy and integrity of the individual) and 
Article 4(2), first indent (protection of commercial interests of a natural or legal person) for 
the reasons set out below. 

2.1 Protection of commercial interests 

In accordance with Article 4(2), first indent, of the Regulation, an institution shall refuse 
access to a document where disclosure would undermine the protection of commercial 
interests of a natural or legal person, including intellectual property, [...], unless there is an 
overriding public interest in disclosure. 

The deliverables of the project iBorderCtrl, to which you request access, contain consortium 
confidential information about the methodology, research approach and strategy as to how the 
iBorderCtrl consortium proposes to achieve the project results. 

More precisely, deliverables Dl.l, D1.2, D1.3 and D2.3 include ethics and legal assessment 
of tools, technical components and methodologies developed within the project. 

Deliverable D2.1 addresses technological solutions and developments (e.g. document analysis 
tools, biometric technologies, technologies for the detection of contraband, analytics for data 
mining) providing the general framework for all the different modules that will compose the 
final integrated system. 

This information has to be considered as inside knowledge of the iBorderCtrl consortium. It 
reflects the specific intellectual property, on-going research, know-how, methodologies, 
techniques and strategies which belong to the consortium. 

As stated in the reply to the initial application, the public disclosure of such information 
would undermine the commercial interests of the iBorderCtrl consortium within the meaning 
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of Article 4(2), first indent, of Regulation 1049/2001, as it would give an unfair advantage to 
the (potential) competitors of the consortium. By having access to the commercially sensitive 
information in the documents requested, the competitors would be able to profit from it, as 
follows. 

First, the public disclosure would give the competitors the opportunity to anticipate the 
strategies and weaknesses of the partners of the iBorderCtrl consortium, including when 
competing in calls for tenders and proposals. 

Secondly, the public disclosure would give their competitors the opportunity to copy or use 
the intellectual property, know-how, methodologies techniques and strategies of the 
iBorderCtrl consortium. The competitors would be able to employ this information in order to 
improve the production of their own competing products or provision of their own competing 
services. Furthermore, this would also result in the competitors having an unfair advantage 
when seeking and obtaining patents, approvals, authorisations and/or designations for their 
products or services. 

Thirdly, the public disclosure would also undermine the possibilities of the partners of the 
iBorderCtrl consortium to obtain funding from existing and potential new investors. Given the 
competitive environment in which the project consortium operates, the information in 
question can only maintain its commercial value if it is kept confidential. 

Fourthly, the public disclosure of information in the requested documents could affect the 
reputation of the iBorderCtrl consortium members and the individuals linked with it. 

Against this background, the disclosure would clearly adversely affect the competitive 
position of the iBorderCtrl consortium on the market and, in turn, seriously undermine their 
commercial interests, including their intellectual property. 

I wish also to point out in this regard that, in accordance with Article 3 of H2020 Rules for 
participation, “ Subject to the conditions established in the implementing agreements, 
decisions or contracts, any data, knowledge and information communicated as confidential in 
the framework of an action shall be kept confidential, taking due account of Union law 
regarding the protection of and access to classified information 

This confidentiality provision is implemented in the H2020 Model Grant Agreement. Its 
Article 36 stipulates that “ During implementation of the action and for four years after the 
period set out in Article 3, the parties must keep confidential any data, documents or other 
material (in any form) that is identified as confidential at the time it is disclosed (“confidential 
information ”). ” 

Article 36 also provides that “the Agency may disclose confidential information to its staff, 
other EU institutions and bodies. It may also disclose it to third parties, if (a) this is necessary 
to implement the Agreement or safeguard the EU’s financial interests and (b) the recipients of 
the information are bound by an obligation of confidentiality." 

In the Grant Agreement for the project iBorderCtrl, the requested deliverables not disclosed to 
you are listed as ‘confidential’, bearing the following confidentiality marking “Confidential, 
only for members of the consortium (including the Commission Services and/or REA 
Services)”. 
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Please note that the General Court has addressed the issue of contractual confidentiality, 
under the EU Framework Programmes for Research and Innovation, in its Technion 
judgment 2 . It ruled that, if a contractual clause in the Grant Agreement provides that the 
Commission must use the documents and information, provided by a beneficiary, on a 
confidential basis, those documents and information cannot (within the timeframe set out in 
the Grant Agreement) be disclosed or released to persons not party to the contract. 

The General Court confirmed that “ disclosure of the documents on the basis of Regulation No 
1049/2001 would undermine the very existence of that clause of the contract, inasmuch as it 
would allow persons not party to the contract, namely the general public, access to the 
abovementioned documents 

The exception of Article 4(2), first indent, of Regulation 1049/2001 must, therefore, be 
interpreted also in line with the confidentiality provisions of H2020 Rules for Participation 
and its implementing acts. 

It is consistent case-law that when two regulations regulate access to documents, without one 
of them having precedence as in the present case, they have to be applied in a manner 
compatible with the other and which enables a coherent application of them 3 . 

Furthermore, the exception of Article 4(2), first indent, of Regulation 1049/2001 has to be 
read also in light of Article 339 of the Treaty on the Functioning of the European Union 
(TFEU), which requires staff members of the EU institutions to refrain from disclosing 
information of the kind covered by the obligation of professional secrecy, in particular 
information about undertakings, their business relations or their cost components. 

I take the view that applying Regulation 1049/2001 cannot have the effect of rendering the 
above-mentioned provisions, in particular Article 339 TFEU, over which it does not have 
precedence, ineffective. 

In consequence, there is a real and non-hypothetical risk that public access to the documents 
requested would undermine the commercial interests, including intellectual property, of the 
iBorderCtrl consortium. I conclude, therefore, that access to the documents requested has to 
be refused on the basis of the exception laid down in Article 4(2), first indent (protection of 
commercial interests), of Regulation 1049/2001. 

2.2. Protection of privacy and the integrity of the individual 

Article 4(1 )(b) of Regulation 1049/2001 provides that [t]he institutions shall refuse access to a 
document where disclosure would undermine the protection of [...] privacy and the integrity 
of the individual, in particular in accordance with Community legislation regarding the 
protection of personal data. 

The applicable legislation in this field is Regulation (EC) No 2018/1725 of the European 
Parliament and of the Council of 23 October 2018 on the protection of natural persons with 
regard to the processing of personal data by the Union institutions, bodies, offices and 


2 Judgment of the General Court in Technion v Commission, T-480/11, EU:T:2015:272, paragraph 58. 

3 Judgment of 28 June 2012 in Commission v Editions Odile Jacob SAS, C-404/10 P, EU:C:2012:393, paragraph 
110 . 
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agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 
and Decision No 1247/2002/EC (‘Regulation 2018/1725’). 

The documents to which you request access contain personal data, in particular the documents 
requested contain information related to identified or identifiable individuals involved in or 
linked to the iBorder project, in particular their names, functions, contact data and opinions. 
Indeed, Article 3(1) of Regulation 2018/1725 provides that personal data ‘ means any 
information relating to an identified or identifiable natural person [...]’. The Court of Justice 
has specified that any information, which by reason of its content, purpose or effect, is linked 
to a particular person is to be considered as personal data. 

In its judgment in Case C-28/08 P (Bavarian Lager) 4 , the Court of Justice ruled that when a 
request is made for access to documents containing personal data, the Data Protection 
Regulation becomes fully applicable 

Pursuant to Article 9(l)(b) of Regulation 2018/1725, “ personal data shall only be transmitted 
to recipients established in the Union other than Union institutions and bodies if '[t]he 
recipient establishes that it is necessary to have the data transmitted for a specific purpose in 
the public interest and the controller, where there is any reason to assume that the data 
subject's legitimate interests might be prejudiced, establishes that it is proportionate to 
transmit the personal data for that specific purpose after having demonstrably weighed the 
various competing interests". 

Only if these conditions are fulfilled and the processing constitutes lawful processing in 
accordance with the requirements of Article 5 of Regulation 2018/1725, can the transmission 
of personal data occur. 

According to Article 9(l)(b) of Regulation 2018/1725, REA has to examine the further 
conditions for a lawful processing of personal data only if the first condition is fulfilled, 
namely if the recipient has established that it is necessary to have the data transmitted for a 
specific purpose in the public interest. It is only in this case that REA has to examine whether 
there is a reason to assume that the data subject’s legitimate interests might be prejudiced and, 
in the affirmative, establish the proportionality of the transmission of the personal data for that 
specific purpose after having demonstrably weighed the various competing interests. 

In your request, you do not put forward any arguments to establish the necessity to have the 
data transmitted for a specific purpose in the public interest. Therefore, REA does not have to 
examine whether there is a reason to assume that the data subject’s legitimate interests might 
be prejudiced. 

Notwithstanding the above, please note that there are reasons to assume that the legitimate 
interests of the data subjects concerned would be prejudiced by disclosure of the personal data 
reflected in the documents, as there is a real and non-hypothetical risk that such public 
disclosure would harm their privacy and subject them to unsolicited external contacts. 

Consequently, I conclude that, pursuant to Article 4(1 )(b) of Regulation 1049/2001, access 
cannot be granted to the personal data, as the need to obtain access thereto for a purpose in the 
public interest has not been substantiated and there is no reason to think that the legitimate 


4 Judgment of 29 June 2010, Commission v Bavarian Lager, C-28/08 P, EU:C:2010:378. 
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interests of the individuals concerned would not be prejudiced by disclosure of the personal 
data concerned. 

3. OVERRIDING PUBLIC INTEREST 

Please note that Article 4(1 )(b) of Regulation 1049/2001 does not include the possibility for 
the exception defined therein to be set aside by an overriding public interest. 

The exception laid down in Article 4(2), first indent, of Regulation 1049/2001 must be waived 
if there is an overriding public interest in disclosure. Such an interest must, firstly, be public 
and, secondly, outweigh the harm caused by disclosure. 

In your confirmatory application, you do not put forward any reasoning pointing to an 
overriding public interest in disclosing the documents requested. Nor have I been able to 
identify any public interest capable of overriding the interests protected by Article 4(2), first 
indent, of Regulation 1049/2001. 

4. PARTIAL ACCESS 

In accordance with Article 4(6) of Regulation 1049/2001, I have considered the possibility of 
granting partial access to the documents requested. However, for the reasons explained here 
above, no further partial access is possible without undermining the interests described above. 

Consequently, I have come to the conclusion that the documents requested are covered in 
their entirety by the invoked exceptions to the right of public access. 

5. CONCLUSION 

I have come to the conclusion that except for deliverables D7.3 (Dissemination and 
communication plan) and D7.8 (Dissemination and communication plan 2) that can be sent to 
you, for the above mentioned reasons, REA considers that, in absence of overriding public 
interests, it has the duty not to grant access to the requested documents according to Article 
4(2), first indent, of Regulation (EC) No 1049/2001 as the prevailing interest is, in this case, 
the protection of the commercial interests including intellectual property of the third parties 
concerned. 

6. MEANS OF REDRESS 

I draw your attention to the means of redress available against this decision. You may, under 
the conditions of Article 263 TFEU, bring proceedings before the General Court or, under the 
conditions of Article 228 TFEU, file a complaint with the European Ombudsman. 

Yours sincerely, 


Marc TACHELET 



Enclosures: - Deliverable D7.3 Dissemination and communication plan 
- Deliverable D7.8 Dissemination and communication plan 2 
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| Electronically signed on 22/01/2019 14:22 (UTC+Ol) in accordance with article 4.2 (Validity of electronic documents) of Commission Decision 2004/563 


